Vulnerability details

CVE-2025-0593

SICK InspectorP8xxSICK Lector8xx

SICK Lector8xx and InspectorP8xx vulnerable for code execution

CVSS 3.1

8.8High

Official description

The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device.

CVSS scores

Score	Version	Source	Vector
8.8High	3.1	CVEProject cvelistV5 (CNA) (SICK AG)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
SICK AG	SICK InspectorP8xx	v < 3.11.1	CVEProject cvelistV5 (CNA)
SICK AG	SICK Lector8xx	v < 2.4.0	CVEProject cvelistV5 (CNA)

References and advisories

https://sick.com/psirt x_SICK PSIRT Website
https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF x_ICS-CERT recommended practices on Industrial Security
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices x_ICS-CERT recommended practices on Industrial Security
https://www.first.org/cvss/calculator/3.1 x_CVSS v3.1 Calculator
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0002.pdf vendor-advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0002.json vendor-advisoryx_csaf

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-02-14
Last updated: 2025-02-15
State: Published
Assigner (CNA): SICK AG

Exploit prediction (EPSS)

0.78%

Probability of exploitation in 30 days

56.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')